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-Abstract- 

We study a generalisation of sabotage games, a model of dynamic network games introduced by 
van Benthem [20]. The original definition of the game is inherently finite and therefore does not 
allow one to model infinite processes. We propose an extension of the sabotage games in which 
the first player (Runner) traverses an arena with dynamic weights determined by the second 
player (Saboteur). In our model of quantitative sabotage games, Saboteur is now given a budget 
that he can distribute amongst the edges of the graph, whilst Runner attempts to minimise the 
quantity of budget witnessed while completing his task. We show that, on the one hand, for most 
of the classical cost functions considered in the literature, the problem of determining if Runner 
has a strategy to ensure a cost below some threshold is EXPTIME-complete. On the other hand, 
if the budget of Saboteur is fixed a priori, then the problem is in PTIME for most cost functions. 
Finally, we show that restricting the dynamics of the game also leads to better complexity. 
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Quantitative Games under Failures 


1 Introduction 

Two-player games played on graphs are nowadays a well-established model for systems where 
two antagonistic agents interact. In particular, they allow one to perform controller syn¬ 
thesis PP, when one of the players models the controller, and the second plays the role of an 
evil environment. Quantitative generalisations (played on weighted graphs) of these models 
have attracted much attention in the last decades ei Eiia as they allow for a finer analysis 
of those systems. 

In this setting, most results assume that the arena (i.e., the graph) on which the game 
is played does not change during the game. There are however many situations where this 
restriction is not natural, at least from a modelling point of view. For instance, Griiner et al. 
[7] model connectivity problems in dynamic networks (i.e., subject to failure and restoration) 
using a variant of sabotage games - a model originally proposed by van Benthem 120] - to 
model reachability problems in a network prone to errors. A sabotage game is played on a 
directed graph, and starts with a token in an initial vertex. Then, Runner and Saboteur 
(the two players of the game) play in alternation: Runner moves the token along one edge 
and Saboteur is allowed to remove one edge. Runner wins the game if he reaches a target set 
of vertices. In [HJ], it is shown that deciding the existence of a winning strategy for Runner 
is PS PACE-complete. 

In those sabotage games, errors are regarded as unrecoverable failures. In practice, this 
hypothesis might be too strong. Instead, one might want to model the fact that certain 
uncontrollable events incur additional costs (modelling delays, resource usage...), and look 
for strategies that allow one to fulfil the game objective at a minimal cost , whatever the 
occurrence of uncontrollable events. For instance, if the graph models a railway network, 
the failure of a track will eventually be fixed, and, in the meantime, trains might be slowed 
down on the faulty portion or diverted, creating delays in the journeys. It is thus natural 
to consider quantitative extensions of sabotage games, where Saboteur controls the price of 
the actions in the game. This is the aim of the present paper. 

More precisely, we extend sabotage games in two directions. First, we consider games 
played on weighted graphs. Saboteur is allotted an integral budget B that he can distribute 
(dividing it into integral parts) on the edges of the graph, thereby setting their weights. At 
each turn, Saboteur can change this distribution by moving k units of budget from an edge 
to another edge (for simplicity, we restrict ourselves to k = 1 but our results hold for any 
k). Second, we relax the inherent finiteness of sabotage games (all edges will eventually be 
deleted), and consider infinite horizon games (i.e., plays are now infinite). In this setting, the 
goal of Runner is to minimise the cost defined by the sequence of weights of edges visited, 
with respect to some fixed cost function (Inf, Sup, Limlnf, LimSup, average or discounted- 
sum), while Saboteur attempts to maximise the same cost. We call these games quantitative 
sabotage games (QSG, for short). 

Let us briefly sketch one potential application of our model, showing that they are useful 
to perform synthesis in a dynamic environment. Our application is borrowed from Suzuki 
and Yamashita m who have considered the problem of motion planning of multiple mobile 
robots that interact in a finite space. In essence, each robot executes a “Look-Compute- 
Move” cycle and should realise some specification (that we could specify using LTL, for 
instance). For simplicity, assume that at every observation (Look) phase, at most one other 
robot has moved. Clearly every motion phase (Move) will require different amounts of time 
and energy depending on the location of the other robots. We can model the interaction of 
each individual robot against all others using a QSG where Runner is one robot, Saboteur 
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is the coalition of all other robots, and the budget is equal to the number of robots minus 1. 
This model allows one to answer meaningful questions such as l what is, in the worst case, 
the average delay the robot incurs because of the dynamics of the system?', or l what is the 
average amount of additional energy required because of the movements of the other robots?' 
using appropriate cost functions. 

As a second motivational example, let us recall the motivation of the original Sabotage 
Game: consider a situation in which you need to find your way between two cities within a 
railway network where a malevolent demon starts cancelling connections? This is called the 
real Travelling Salesman Problem by Benthem m ■ However, in real life, railway compan¬ 
ies have contracts with infrastructure companies which ensure that failures in the railway 
network are repaired withing a given amount of time (e.g. a service-level agreement). In 
this case, it is better to consider delays instead of absolute failures in the network. Further, 
salesmen do not usually have one single trip in their whole carriers. For modelling purposes, 
one can in fact assume they never stop travelling. In this setting, QSGs can be used to 
answer the question: ‘ what is, in the worst case, the average delay time incurred by the 
salesman ’? Our model can be used to treat the same questions for other networks and not 
just railway networks. 

Related Works & Contributions. Variations of the original sabotage games have been 
considered by students of van Benthem. In na, the authors have considered changing the 
reachability objective of Runner to a safety objective, and proved it is PSPACE-complete as 
well. They also consider a co-operative variation of the game which, not surprisingly, leads 
to a lower complexity: NL-complete. In m an asymmetric imperfect information version 
of the game is studied—albeit, under the guise of the well-known parlor game Scotland 
Yard —and shown to be PSPACE-complete. We remark that although the latter version of 
sabotage games already includes some sort of dynamicity in the form of the Scotland Yard 
team moving their pawns on the board, both of these studies still focus on inherently finite 
versions of the game. 

We establish that QSGs are EXPTIME-complete in general. Our approach is to prove 
the result for a very weak problem on QSGs, called the safety problem , that asks whether 
Runner can avoid ad vitam ceternam edges with non-zero budget on it. We remark that 
although the safety problem is related to cops and robbers games pm we were not able to 
find EXPTIM E-hard variants that reduce easily into our formalism 0 The general problem 
being EXPTIME-complete, we consider the case where the budget is fixed instead of left as 
an input of the problem (see Corollary [2| . We also consider restricting the behaviour of 
Saboteur and define a variation of our QSGs in which Saboteur is only allowed to choose an 
initial distribution of weights but has to commit to it once he has fixed it. We call this the 
static version of the game. For both restrictions, we show that tractable algorithms exist for 
some of the cost functions we consider. A summary of the complexity results we establish 
in this work is shown in Table [T] In Section [6j we comment on several implications of the 
complexity bounds proved in this work. 

2 Quantitative sabotage games 

Let us now formally define quantitative sabotage games (QSG). We start with the definition 
of the cost functions we will consider, then give the syntax and semantics of QSG. 


We compare to related works on cops and robbers games in Appendix |a| 
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Table 1 Complexity results for quantitative sabotage games 



QSG 

static QSG 

fixed budget QSG 

Inf, Limlnf 

£ EXPTIME 

£ PTIME 

£ PTIME 

Sup, LimSup, Avg 

EXPTIME-c 

coN P-c 

£ PTIME 

DS 

EXPTIME-c 

coN P-c 

£ IMP n coNP 


Cost functions. A cost function f: Q“ —► R associates a real number to a sequence of 
rationals u = (wi)i^o G The six classical cost functions that we consider are 

h lnf(u) = inf{uj | i ^ 0}; 
m Sup(w) = sup{uj | i ^ 0}; 
m Limlnf(u) = liminfn-^oojui | i^n}; 
h LimSup(w) = limsup^^^jui | i ^ n}; 

m Avg(u) = lim inf-rj-j.oo 1 Y^i=o u i-> which stands for the average cost (also called mean- 
payoff in the literature); and 

- DS a (■ u ) = A* • m , (with 0 < A < 1), stands for discounted-sum. 

In the following, we let DS = {DSa | 0 < A < 1}. 

Syntax. As sketched in the introduction, quantitative sabotage games are played by Runner 
and Saboteur on a directed weighted graph, called the arena. A play alternates between 
Runner moving the token along the edges and Saboteur modifying the weights. We consider 
that Saboteur has a fixed integer budget B that he can distribute on edges, thereby setting 
their weights (which must be integer values). Formally, for a finite set E and a budget 
B £ N, A (E,B) denotes the set of all distributions of budget B on E, where a distribution 
is a function 6: E —► {0,1,..., B} such that ^ ^ (the constraint is an 

inequality since the whole budget need not be distributed on E). Then, a quantitative 
sabotage game is a tuple Q = (V, E, B,vi,Si, /), where (V,E) is a directed graph, B £ N is 
the budget of the game, vi £ V is the initial vertex, Si £ A (E, B) is the initial distribution 
of the budget, and / is a cost function. We assume, without loss of generality, that there 
are no deadlocks in (V,E), i.e., for all v £ V, there is v' £ V such that (v,v r ) £ E. In the 
following, we may alternatively write A(C?) for A (E,B) when Q is a QSG with set of edges 
E and budget B. 

Semantics. To define the semantics of a QSG Q, we first formalise the possible redistri¬ 
butions of the budget by Saboteur. We choose to restrict them, reflecting some physical 
constraints: Saboteur can move at most one unit of weight in-between two edges. For 
<5, S' £ A (Q), we say that S' is a valid redistribution from <5, noted d > S' , if and only if there 
are ei,e 2 £ E such that S'(e i) £ {S(ei),S(ei) — 1}, <5'(e2) £ {Sfa), 5 fa) + 1}, and for all 
other edges e ^ {ei,e 2 }, S'(e) = S(e). Then, a play in a QSG Q = ( V,E,B,vi,Si, f ) is 
an infinite sequence 7r = uodo^i^i • • • alternating vertices Vi £ V and budget distributions 
Si £ A (Q) such that (z) Vq = vr; (ii) <5o = Si ; and (in) for all i Js 0: (uj, t^+i) £ E , and 
Si > Let PrefsA(f?) denote the set of prefixes of plays ending in a budget distribution, 
and Prefsy(Cy) the set of prefixes of length at least 2 ending in a vertex. We abuse nota¬ 
tions and lift cost functions / to plays letting f(voSoViSi • ■ ■) = f(So(vo , vi)Si(vi,V 2 ) • • ■). 
A strategy of Runner is a mapping p : PrefsA(f7) —> V such that (v n , p(n)) £ E for all 
7r = VoSo ■ ■ ■ v n S n £ PrefsA(f/)- A strategy of Saboteur is a mapping er: Prefsy(ty) —> A (Q) 
such that <5 ra _i > cr(7r) for all 7r = VqSq • • ■ v n -iS n -iV n £ Prefsy(ty). We denote by £r ui1 (£) 
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(respectively, Es a b(0)) the set of all strategies of Runner (respectively, Saboteur). A pair 
of strategies (p,cr) of Runner and Saboteur defines a unique play 7 t P i(T = • • • such 

that for all i ^ 0: (i) Vi+i = p(vq8o ■ ■ ■ ViSi); and (ii) 8i+\ = a(v o^o ■ ■ ■ u»5jU»+i). 


Values and determinacy. We are interested in computing the best value that each player 
can guarantee no matter how the other player plays. To reflect this, we define two val¬ 
ues of a QSG Q: the superior value (modelling the best value for Runner)as Val(£?) := 
su Po-e£ S ab(6) ^ n ^p 6 E Run( 6 ) f( n p,o r)i an d the inferior value (modelling the best value for Sabo¬ 
teur) as Val(<?) := inf peERun ( 5 ) sup CTeSsab(e) f(n Pt „). It is folklore to prove that Val(<?) < 
Val(£r). Indeed, for the previously mentioned cost functions, we can prove that QSGs are 
determined, i.e., that Val (t/) = Val(^) for all QSGs Q. This can be formally proved by 
encoding a QSG Q into a quantitative two-player game [(?] (whose vertices contain both 
vertices of Q and budget distributions), and then using classical Martin’s determinacy the¬ 
orem |T1], as formally done in Appendix |b| Val (Q) = Val(ty) is henceforth called the value 
of Q, and denoted by Val(Cy). 


I) 


Figure 1 A QSG 


Example. Consider the simple QSG Q in Figure [T] where the budget 
of Saboteur is B = 4, and the cost function is Avg. We claim that 
whatever the initial configuration, Val(Cy) = 2. Indeed, consider the 
strategy of Saboteur that consists in eventually putting all the budget 
on the edge (®,(2)) (i.e., letting <5(Q, ®) = 4 and 8(e) = 0 for all 
other edges e), and then playing as follows: whenever Runner reaches 
(2), move one unit of budget from (®,®) to (®, ®); if Runner moves 
to (3), move the unit of budget from ((2), (3)) to (®,®); and when Runner moves back to 
®, move all the budget back on (®,®), by consuming one unit either from ((2),(3)) or from 
(®,®). ^et us ca ^ this strategy a. Since we consider the average cost, only the long-term 
behaviour of Runner is relevant to compute the cost of a play. So, as soon as Saboteur has 
managed to reach a distribution 5 such that £(®,®) = 4, the only choices for Runner each 
time he visits ® are either to visit the (T)-@-(3)-(l) c y c I e i or the (T)-®-® cycle. In the 
former case, Runner traverses 3 edges and pays 4+1 + 1 = 6, hence an average cost of | = 2 
for this cycle. In the latter, he pays an average of 4±2 = 2 for the cycle. Hence, whatever 
the strategy p of Runner, we have Avg^g^p) = 2, which proves that Val (ty) ^ 2. One can 
check that the strategy p of Runner consisting in always playing the Q-®-®-® cycle 
indeed guarantees cost 2, proving that Val(C?) ^ 2. This proves that the value Val(C/) of 
the game is 2. 


3 Solving quantitative sabotage games 

Given a QSG, our main objective is to determine whether Runner can play in such a way 
that he will ensure a cost at most T, no matter how Saboteur plays, and where T is a given 
threshold. This amounts to determining whether Val(t/) ^ T. Thus, for a cost function 
/, the Threshold PROBLEM with cost FUNCTION / consists in determining whether 
Val(C/) ^ T, given a QSG Q with cost function / and a non-negative threshold T. When 
/ = DS, we assume that the discount factor A is part of the input. If we want it to be 
a parameter of the problem (and not a part of the input), we consider / = DSa- Our 
main contribution is to characterise the complexity of the threshold problem for all the cost 
functions introduced before, as summarised in the following theorem: 
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► Theorem 1. For cost functions Sup. LimSup. Avg. DS and DSa, the threshold problem 
over QSGs is EXPTIME -complete; for Inf and Limlnf, it is in EXPTIME. 

For all cost functions, the EXPTIME membership is established by using the encoding 
(explained in Appendix u of a QSG Q into a classical quantitative two-player game [C?] 
which is played on a weighted graph, whose vertices are the configurations of the sabotage 
game, i.e., a tuple containing the current vertex, the last crossed edge and the current 
weight distribution, and whose weights are in {0,..., B} (describing how much runner pays 
by moving from one configuration to another). Notice that A (Q) has size at most (S + 1)I E I, 
since every distribution is a mapping of E —> {0,1,.Hence, we see that the game 
[(?] has a number of vertices at most exponential with respect to \V\, and polynomial with 
respect to B (which, being given in binary, can be exponential in the size of the input of the 
problem). Using results from [23J J2\ T] , we know that we can compute in pseudo-polynomial 
time the value of the quantitative game [(?] for all the cost functions cited in the theorem: 
here, pseudo-polynomial means polynomial with respect to the number of vertices and edges 
of \Q\ (which is exponential with respect to | V|), and polynomial with respect to the greatest 
weight in absolute value, here B (which is also exponential with respect to |V|). Thus we 
obtain the exponential time upper bound announced in the theorem. Note that for DSa, 
pseudo-polynomial also means polynomial in the value of the denominator of A{^] 

When the budget B is fixed, i.e., when it is a parameter of the problem and not one of 
the inputs, the explanation above can be adapted to prove that the problem is solvable in 
polynomial time for all but the DSa cost functions. Indeed, we can refine our analysis of the 
size of A (Q). A budget distribution can also be encoded as a mapping 7 : {1,... ,B} —> E 
where we consider the budget as a set of indexed pebbles: such a mapping represents the 
distribution <5 defined by 1 5(e) = | 7 - 1 (e)|. This encoding shows that A(Q) has size at most 
\E\ B , which is polynomial in \E\. For the discounted sum, the role of A in the complexity 
stays the same, causing an NP n coNP and pseudo-polynomial complexity: this blow-up 
disappears if A is a parameter of the problem. In the overall, we obtain: 

► Corollary 2. For cost functions Inf, Sup. Limlnf. LimSup. Avg. DSa, and for fixed budget 
B, the threshold problem for QSG s is in PTIME: for DS (where A is an input), it is in 
NPflcoNP and can be solved in pseudo-polynomial time. 

The rest of this section is devoted to the proof of EXPTIM E-hardness in Theorem [T] for 
cost functions Sup, LimSup, Avg and DSa (this implies EXPTIM E-hardness for DS too). Our 
gold-standard problem for EXPTIM E-hardness is the alternating Boolean formula (ABF) 
problem, introduced by Stockmeyer and Chandra in m- Our proof consists of a sequence 
of reductions from this problem, as depicted in Figure [2j First, we show a reduction to the 
threshold problem for Sup cost function when the threshold is 0 and the initial distribu¬ 
tion is empty (i.e., no budget on any edge), on QSGs extended with safe edges and final 
vertices (in order to make the reduction more readable). Notice that this problem amounts to 
determining whether Runner has a strategy to avoid crossing an edge with non-zero budget, 
therefore we refer to this problem as the extended safety problem ( ESPr ). Our next step is 
to encode safe edges and final vertices into (non-extended) QSGs with gadgets of polynomial 
size, therefore proving that the safety problem ( SPr ) is itself EXPTIM E-hard: SPr is a special 
case of the threshold problem ThPrs up (0) with Sup cost function and threshold 0, for empty 


2 In case of discounted-sum, we design [(?] with a discount factor \f\ (not necessarily rational), but we 
ensure that only one turn over two has a non-zero weight, so that we may indeed apply the reasoning 
of [23] and their pseudo-polynomial algorithm. 
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ThPros x ThPr Sup 

t _ t 

ThPr d Sa (0) ThPr Sup (0) 

ABF - 7 - ==— ESPr - 

Lem.m 

Figure 2 Reductions used in this section. We denote by ThPrf (respectively, ThPrf( 0)) the 
threshold problem (respectively, the sub-problem of the threshold problem where threshold is 0) 
for QSGs with cost function /. Non-trivial reductions are labelled with the corresponding lemma 
stated in this section. 


ThPr \jmSup ThPrup 

t m t 

7WY LimSup (0) ^WThPr M p(0) 



initial distributions. Reductions to threshold problems with other cost functions close our 
discussion to prove their EXPTIM E-hardness. 

Alternating Boolean Formula. We first recall the alternating Boolean formula problem 
(ABF) introduced as game G 6 in [T5], which is the EXPTIME-hard problem from which 
we perform our reductions. Intuitively, an ABF is an (infinite) game played on a Boolean 
formula whose variables are partitioned into two sets. Each player controls the values of 
one of the sets of variables. Players take turns changing the value of one of the variables 
they control. The objective of the first player (Prover) is to eventually make the formula 
true, while the second player (Disprover) tries to avoid this. We note that this game closely 
resembles an infinite horizon version of the more classical QBF Problem. 

More formally, an ABF instance is given by two finite disjoint sets of Boolean variables, 
X and Y, and a CNF formula over X U Y. The game is played by two players called Prover 
and Disprover. They take turns changing the value of at most one of the variables they own 
( X are the variables of Prover, and Y those of Disprover). Prover wins if and only if the 
formula is eventually true. A configuration of this game is thus a pair (val, Player) where 
val is the current valuation of the variables and Player indicates which player should play 
next. The ABF problem consists in, given an ABF game and an initial configuration, 
determining whether Disprover has a winning strategy from the initial configuration. It is 
shown EXPTIME-complete in m- 

► Example 3. Consider the formula $ = Cl\ A CI 2 A CI 3 A CI 4 where Cl\ = A V —>C, 
CI 2 = C V .D, CI 3 = C V -*D and CI 4 = B V ~^B. Let us further consider the partition of 
the variables into the sets X = {A, B} of Prover, and Y = {C, D} of Disprover; and the 
initial configuration (val, Prover), where val = {B,C, D} (we denote a valuation by the set 
of all variables it sets to true). Clearly, in this initial configuration, d> is false since Cli is 
false. From that configuration, Prover can either set A to true, or B to false. In the former 
case, one obtains the configuration ({A, B, C, D}, Disprover), where Prover wins, as $ now 
evaluates to true. In the latter case, one obtains the configuration ({C, D}, Disprover). We 
claim that, from this configuration, Prover cannot win the game anymore, i.e., Disprover 
has a winning strategy that consists in first setting C to false, and in, all subsequent rounds, 
always flipping the value of D, whatever Prover does. Playing according to this strategy 
ensures Disprover to force visiting only configurations where either CI 2 or CI 3 is false. 

Extended QSG. To make the encoding of ABF instances into QSG easier, we introduce 
extended quantitative sabotage games (with Sup cost function). Those games are QSG with 
Sup cost function, a designated subset F C V of final vertices and a designated subset S C E 
of safe edges (those special vertices and edges are henceforth depicted with double lines). 
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Figure 3 Verifying condition (i) Figure 4 Verifying condition (ii) 


F and S influence the semantics of the game: Saboteur can place some budget on final 
vertices (which is accounted for in the cost when Runner visits those vertices), but cannot 
put budget on safe edges; and the game stops as soon as Runner visits a final vertex. We 
consider the extended safety problem (ESPr ), which is to determine whether an extended 
QSG Q with empty initial distribution has value Val(t7) ^ 0. 

Since the cost function is Sup, this amounts to checking that Runner has a strategy to 
reach a final vertex, with no budget assigned to it, without crossing any edge with non-null 
budget. From now on, we assume B < |2£|, as the problem is trivial otherwise. Then: 

► Lemma 4. The ABF problem is polynomial-time reducible to ESPr. 

Sketch. We consider an instance of the ABF problem given by Boolean variable sets A' and 
Y (owned by Prover and Disprover, respectively) and a CNF formula over A'UF. We 
construct an extended QSG £ such that Saboteur wins in £ if and only if Prover wins in the 
ABF problem. Valuations of the variables in X U Y are encoded by budget distributions 
in £. For each variable x £ X U Y, £ has 4 final vertices associated with x, Ver(x) = 
, -ix( 2 \ x^\ x^ 2 ' 1 }. A budget distribution 6 encodes a valuation in which variable 
x £ X U Y is true if and only if ^(ajW) = 5(x^) = 1 and <5(—la;^ 1 ^) = 5(~<x^) = 0. 

Then, £ simulates the ABF game as follows. The duty of Saboteur is to move the budget 
distribution in such a way that he respects the encoding of the valuations explained above. 
To enforce this, we rely on the two gadgets, depicted in Figure [3] and [4] They allow Runner 
to check that Saboteur respects the encoding and let him lose if he does not. More precisely, 
the gadget in Figure [3] allows one to check that (*) there is a non-zero budget on at least 
two vertices from Ver(a;); and the one in Figure [4] that (ii) there is a non-zero budget on 
exactly {-lad 1 ), -<x^ 2 l} or {au 1 !, x^}. To allow Runner to check one of these conditions, we 
allow him to move to one of the four corner vertices of the corresponding gadget, from where 
one can easily check Runner can win if and only if the condition is not respected. In our 
reduction, Runner will be allowed to check condition (i), for all variables, from all vertices 
but will be able to check (ii) only on some of them, as we will see later. 

The remaining of the construction is done in a way to allow Saboteur and Runner to 
choose valid re-configurations of Ver(x) for all variables x, and make sure that if a player 
cheats, it allows the other player to win the safety game. If at some point, the formula $ 
becomes true, then we allow Saboteur to enter a final gadget which verifies that the current 
budget distribution to Ver(X) = (J^exu y V er ( x ) satisfies 4>. This last gadget lets Runner 
choose a clause and then allows Saboteur to choose a literal, within this clause, which should 
be true. It is easy to see that the choice of clause Cl can be done by way of safe edges. The 
choice of literal, done by Saboteur, consists in choosing a suffix of Cl for which the left-most 
literal holds. Figure [5] shows the ESPr which results from applying our construction to the 
ABF formula from Example [3] We refer the reader to Appendix [Cd] for the full reduction, in 
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Figure 5 Excerpt of the ESPr constructed from the ABF of Example [ 3 ] In addition to these 
nodes and edges, the full ESPr contains: an initialisation gadget; a safe edge from a node n to all 
four corner nodes of gadget (i) in Figurepliff n is labeled by a; and a safe edge from a node n to all 
four corner nodes of gadget (ii) in Figure |4| testing variable x £ {A, B , C , D} iff n is labeled by x. 
These parts have been omitted for the sake of clarity. 


particular how we can force, before the beginning of the actual game, to start in the initial 
valuation of the ABF game. ◄ 


We now explain how to encode safe edges and final vertices into usual QSGs, therefore 
showing the EXPTIME-hardness of the safety problem for QSGs. 


► Lemma 5. The extended safety problem ESPr is polynomial-time reducible to a safety 
problem SPr with budget 2. 


Sketch. Each final vertex v in an extended QSG 8 is replaced by the gadget in Figure [6a] 
where {cq | 1<*^B + I}isa clique of size B + 1, hence bigger than the budget of 
Saboteur. To encode S(v) = 1 in 8 , Saboteur now puts one unit of budget on ((a), (c)) ). If 
Runner reaches the gadget (through (a)), Saboteur puts one unit of budget on ((A), (C*)) )- 
Clearly, Runner loses if and only if there was already one unit on ((a), (Ci)) (i.e., v was 


marked in 8 ). Each safe edge ((a), (c)) is replaced by the gadget in Figure 6b Here, we 
make use of final vertices and disjoint paths so that Saboteur cannot block all paths from 
(( 4 ) to (c) without letting Runner win by visiting a final vertex with zero budget. Both 
gadgets have polynomial size since we assume that B <\E\. < 


As the safety problem is a specific case of the threshold problem for Sup QSGs (where 
the initial distribution is empty, and threshold is fixed to 0), it follows that ThPrs up (0) and 
ThPrsup are EXPTIM E-hard too. 

We note that given a QSG Q, for all plays 7 r in Q, for all 0 < A < 1, and for all S £ A(C/), 
Sup(7f) = 0 if and only if DSa( 7T) = 0. This implies the following result, showing that 
ThPro s x (0) and ThPros x are also EXPTIME-harcl. 

► Lemma 6. For any A £ (0,1), the threshold problem for DSa and threshold 0 is equivalent 
to the threshold problem for Sup and threshold 0. 
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(b) A gadget for safe edges 
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(c) Initial gadget for Sup to LimSup reduction. 
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(d) Exit gadget for Sup to LimSup reduction. 
Dashed arrows represent a (safe) path traversing 
B' sets s* of vertices. 


Figure 6 Dotted arrows represent edges from all sources to all targets. 


Let us now focus on LimSup. To show that TTiPrumSup is EXPTIME-hard, we describe a 
reduction from SPr to T7iPru m s U p(0) as stated in the following lemma. 

► Lemma 7. The safety problem SPr is polynomial-time reducible to the threshold problem 
for LimSup and threshold 0. 

Sketch. Let T = (V. E , B , Vi, Si, Sup) be an instance of SPr (with G(I) its underlying graph 
(V,E)). We build a QSG Q with cost function LimSup such that Val(t/) = 0 if and only if 
Runner wins in T. The idea of the construction is that a play of Q consists in simulating 
a potentially infinite sequence of plays of T, using appropriate gadgets to ‘reset’ the safety 
game between two successive simulations. Then, repeatedly playing a winning strategy for 
X allows Runner to ensure a LimSup of 0 in Q\ and one can extract a winning strategy for 
the safety game X from any strategy ensuring a LimSup of 0 in Q. The QSG Q has budget 
B 1 = \E\ and is obtained by extending G(X) with two gadgets. Note that we are giving 
Saboteur more budget than he had in X. However, as we will see in the sequel, at the 
beginning of every faithful simulation of X (i.e. when Runner moves to G(X)) there will be 
B' — B of it in the second gadget and B in the first and during any faithful simulation of X 
only budget from the initial gadget is redistribtued into G(X). 

The first gadget is an initial gadget which is visited every time the safety game is ‘reset’. 
It allows Runner to stay safe from any weighted edges (and avoid reaching G(X)) until 
Saboteur has placed B units of budget on it (and thus removed them from the G(X). It is 


depicted in Figure 6c where all et are intuitively copies of vi, and post(uj) corresponds to 
the set of all successors of vi in G(X). 

The second gadget allows Runner to leave G(I) if Saboteur ever places more than B 
units of budget on G{T) (and thus removes this budget from the gadgets), thereby triggering 
a ‘reset’ of the simulation. This gadget, depicted in Figure |6dl also allows Runner to come 
back to the initial gadget visiting only edges with zero budget. The figure shows a sequence 
of safe transitions (i.e. several vertices with high out-degree) which leads back to the copies ei 
of the initial vertex. Further, this ‘safe path’ takes long enough for Saboteur to redistribute 
the budget from G(X) to both gadgets. In order for Saboteur to stop Runner from always 
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taking this ‘safe exit’ from G(I) he can place B' — B budget in specific edges of this second 
gadget. More specifically, he can place a unit of budget on one outgoing edge from each Xj, 
for B + 1 ^ j ^ B\ before forcing Runner to enter G{I). 

Intuition behind the global construction. Assume that Saboteur has a winning strategy 
in I. Then, when Runner is in the initial gadget, Saboteur will play as expected and remove 
all weights from G(I). Critically, the weights he removes from G(I) will go to specific edges 
in both gadgets described above. Runner is now forced to play into G(I), and Saboteur 
can follow his winning strategy to hit Runner at some point without using more than B 
weights. If Runner attempts to bail out of G through the alternative exit, and to head back 
to the initial gadget, then we make sure he is also hit by Saboteur. Clearly, this ensures 
that the LimSup value of the game is strictly greater than 0. Now assume that Runner has a 
winning strategy in X. In this case, if Saboteur does not remove all weights from G(I), then 
Runner is allowed to stay in the initial gadget forever or jump to G(X) and immediately bail 
out using the exit gadget. In both cases he avoids getting hit by Saboteur. Let us assume 
Saboteur plays as expected and thus Runner enters G(X) eventually. In this case, Runner 
can play his winning strategy, hence avoiding edges with non-zero budget (with Saboteur 
using budget B). Either he dodges weighted edges forever, or Saboteur cheats and uses 
some of his additional budget. However, in this case he creates an exit for Runner back to 
the initial gadget, and the same analysis as above applies. This implies that the value of 
the game is exactly 0. ◄ 

Proving the EXPTIM E-hardness result for cost function Avg is done by noticing that, for 
threshold 0, both problems are equivalent. 

► Lemma 8. The threshold problem for LimSup and threshold 0 is polynomial-time reducible 
to the threshold problem for Avg and threshold 0. 

4 Static quantitative sabotage games 

In light of the EXPTIM E-completeness of QSGs, we study in this section a restriction of the 
problem, that might be sufficient to model some interesting cases. The restriction concerns 
the dynamics of the behaviour of Saboteur. In a static QSG, Saboteur chooses at the 
beginning a budget distribution (hence, changing the initial budget distribution), and then 
commits to this distribution during the whole game. The situation is no longer a reactive 
two-player game, but rather we ask whether for every possible initial (and static) budget 
distribution, Runner has a nicely behaved strategy. 

Formally, for a QSG Q = (V, E, B, vi, f) (we remove the initial budget distribution from 
the tuple in this section, since it is useless) and a budget distribution S £ A(£/), we denote 
by Gs the QSG obtained from G by taking S as initial budget distribution. Furthermore, 
we define the identity strategy i of Saboteur in £/, as the strategy mapping every prefix 
7r £ Prefssab(f?) to the last budget distribution appearing in prefix 7r. We let Val st at(f?) = 
su P< 5 eA(P) i n fpes Run (P) f( 7 r p,i)i where 7r pt denotes the unique play defined by the profile 
(p, t) in QSG Gs- Notice that this value is equal to inf pe £ Run (g) sup 5gA (gj f( n p, J> since in G , 
when Saboteur follows strategy t, the quantitative game [(?] (see Appendix [B]) is split into 
independent games, one for each initial distribution S, that Runner knows as soon as it starts 
playing. The Static Threshold problem with cost function / consists in, given as 
input a QSG G with cost function / and a non-negative threshold T, determining whether 
the inequality Val sta t(f?) ^ T holds. We now state the complexity of this new problem. 
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► Theorem 9. For cost functions Inf and Limlnf, the static threshold problem over QSGs is 
in PTIME, • for Sup. LimSup. Avg. and DS. it is coUP-complete. 

First, we give the intuition behind our polynomial-time algorithm to decide the static 
threshold problem for cost functions Inf and Limlnf. 

► Lemma 10. For cost functions Inf and Limlnf. the static threshold problem over QSGs is 

in PTIME. 

Sketch. For Inf, we claim that Val stat (C/) = |J.E|/.BJ, where E is the set of edges reachable 
from vj. Indeed once a distribution (5 is chosen, any optimal strategy of Runner will make 
him reach an edge of E that has the minimum weight, thus Saboteur must distribute evenly 
its budget over E. A similar argument works for Limlnf, showing that Val stat (C?) = U-EV-BJ, 
where E is the set of edges reachable from vi and contained in a strongly connected com¬ 
ponent. ◄ 

Then, let us turn to the coNP-completeness of the problem for cost functions Sup, LimSup, 
Avg, and DS. Notice that, because of the two possible definitions of Val sta t(C') explained in 
the beginning of the section, the complement of the static threshold problem asks whether 
there exists a budget distribution 6 such that /(7r^J > T for every strategy p € ER un (C?) 
of Runner. Thus we show the N P-completeness of the complement of the static threshold 
problems for the four cost functions. 

► Lemma 11. For cost functions Sup. LimSup. Avg. and DS, the complement of the static 
threshold problem over QSGs is NP -complete. 

Sketch. For the membership in NP, we can first guess a budget distribution S (that is of size 
polynomial), and then compute the value of the one-player (since player Max has no choices 
anymore) quantitative game Qs, to check if it is greater than T: computing the value of such 
a game can be done in polynomial time for the four cost functions we consider (see HD- 
For the NP-hardness with cost functions LimSup and Avg, we give a reduction from 
the following problem. The Feedback ARC SET problem asks, given a directed graph 
G = (V. E) and a threshold k < | E\, whether there is a set E' of at most k edges of G 
such that ( V,E\E') is acyclic. Karp showed pTO] that the feedback arc set problem is NP- 
complete. Let us consider an instance of the feedback arc set problem, given by a directed 
graph G = (V,E) and a natural integer k ^ \E\. Wlog, we can add to the graph a vertex 
vi, with null in-degree, and, for all vertices v yf vi, an edge (vi,v). Observe that this does 
not change the output of the feedback arc set problem as Vj is not included in any cycle. 
We then construct a QSG Q = ( V,E,k : vi, f ) with / £ {LimSup, Avg}. It is not difficult 
to show that Val stat (f/) > 0 if and only if there exists a set E' of k edges of G such that 
(V. E \ E') is acyclic. The result for Sup and DS is then obtained by a slight modification of 
the previous proof. In particular, we make use of Lemma [6] once more. We refer the reader 
to Appendix |D.2| for the details. ◄ 

5 Reactive systems under failure 

One can see a sabotage game as a system in which a controller tries to evolve while avoiding 
as much as possible the failures caused by the environment. The vertices of the graph 
represent configurations of the system, edges represent the actions, and the budget of the 
Saboteur may represent a finite amount of failures that can simultaneously occur during the 
execution. In a quantitative reasoning, a failure may be better represented by a quantity 
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describing how much some elements of the system are overloaded, and then how much it 
would cost, in terms of time or energy, to use them. 

Following this main motivation, we propose to look at sabotage games as a particular 
semantics of controllable systems. Indeed, while a standard semantics would analyse the 
feasibility of a requirement in a fully functional system, a sabotage semantics allows one to 
analyse systems subject to errors, and to decide, e.g., whether one can satisfy a Boolean 
constraint while minimising the average number of failures encountered during the execution. 
In particular, sabotage games, as introduced in this work, would correspond to the sabotage 
semantics of a system where the controller must walk in a graph with no particular objective, 
other than minimising the failures. 

From a modelling point of view, graphs—which can be viewed as one-player games with 
trivial winning conditions—are quite limited. In more realistic models, we may be interested 
in modelling systems with uncontrollable actions (i.e., two-player games), and where the 
controller has a specific Boolean goal to achieve, instead of simply staying in the graph ad 
vitam aeternam. A more realistic goal is usually expressed via a parity condition or LTL 
formulas. In Appendix [E] we show that when a reactive system is modelled by a two-player 
parity game, deciding whether one can ensure the parity condition, while maintaining a cost 
associated with the sabotage semantics below a given threshold, is not harder than solving 
sabotage games. That is, the problem is EXPTIME-complete. This result is obtained by a 
reduction to quantitative parity games [3]. When the requirement is expressed with an LTL 
formula instead of a parity condition, the problem becomes 2-EXPTIME-complete, due to 
an additional exponential blow-up in the size of the input formula. Note, however, that the 
LTL-reactive synthesis problem itself (with the standard non-sabotage semantics) is already 
2-EXPTIME-complete. In this case, the sabotage semantics does not add to the complexity 
of the problem, which further shows that our present contributions might have practical 
applications, albeit the high complexity. 
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Conclusion 


We have conducted a study of systems subject to failure, using the model of quantitative 
sabotage games. We have shown that under dynamic sabotage , the threshold problem is 
EXPTIME-complete for most objective functions, and coNP-complete under static sabotage, 
for the same functions (see table [T]for a summary of these results). We have also shown the 
applicability of our framework to deal with the more general problem of reactive synthesis 
in systems under failures. The QSGs we have introduced open many questions related to 
evolving structures. Here we have studied the worst-case scenario, i.e., where the environ¬ 
ment is modelled by an antagonistic adversary, but, as considered in HH for reachability 
Boolean objectives, one could also look at a probabilistic model, where failures, i.e., redis¬ 
tributions of weights, are random variables. Another natural extension of this work would 
be to consider a more realistic setting where the controller (Runner) has partial information 
regarding the weights of Saboteur. 

Although the synthesis problem has been widely studied in theory, there are not many 
tools which implement the known theoretical solutions to decide it. The is is particularly 
true for quantitative objectives. Recently, however, competitions have been organised to 
encourage the development of such tools and the standardisation of an input format (see, 
e.g., SYNTCOMP and SyGuS) (^] Motivated by the similarities between the ABF problem 
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Links to both competitions’ websites: http://www.syntcomp.org and http://www.sygus.org/ 
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(solving a safety game described by a logical formula) and the synthesis problem as solved 
in those competition (solving a safety game described by a logical circuit), one of our future 
projects is to show that quantitative extensions of some of the practical tools implemented 
for the reactive synthesis problem could be used to solve sabotage games. 
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A Relation with cops and robbers game 

We observe that the result on safety games is related to the Cops and Robbers games studied mostly by the 
graph theoretical community (see, e.g., [I] and references therein for a survey). We remark that Cops and 
Robbers games are usually defined as played on the vertices of undirected graphs. In [6] it was shown that 
several variants of the Cops and Robbers game without helicopters and, as usual, played on the vertices of an 
undirected graph, are EXPTIME-complete. In contrast, our result implies that the Cops and Robbers game 
played on the edges of a graph with B cops, one helicopter and a slow robber , i.e., which can traverse at most 
one edge per turn, is EXPTIM E-hard. A similar version is studied in [T5] . where they consider helicopters and 
a fast robber. However, the game is played on the vertices of an undirected graph and the complexity of solving 
the game is left open in that paper. It is easy to lift our results to games where weights are placed on vertices 
and no longer on edges by considering line graphs: in contrast, the other direction from vertices to edges would 
have been more difficult, and is not currently known for the best of our knowledge. 


B Encoding of quantitative sabotage games in quantitative games 

In this section, we give formal definitions of quantitative two-player games, and show an exponential encoding of 
QSGs into these games. Thereafter, we choose to call Min and Max the two players of our games, to distinguish 
them from Runner and Saboteur, used in the main part of this article. 

B.l Two-player games 

A weighted arena is a tuple G = (I4iin, VM ax , E,w,vi ) with V = Wim W I4iax a finite set of vertices partitioned 
into the set I4im of vertices of player Min and the set Vm^x of vertices of player Max, E C V 2 is a set of edges, 
w : E — > N is a weight function assigning an integer weight to each edge of the arena, and vi £ V is an initial 
vertex. Given a weight function w: E —> R, we write |iu| for the greatest weight in w, i.e., |in| = max ee E w{e). 

Intuitively, the two players Min and Max move a token along the edges of the graph (V,E), starting on 
vertex u/. When the token is on a vertex of Vmuh it is Min that chooses the next vertex, and when on V^ax, 
it is Max. To allow them to play infinitely, we make the assumption that every vertex v has an outgoing 
edge, i.e., that there exists (v,v') £ E. A strategy for a player is simply a mapping telling him what to play 
depending on the past. Formally, given an arena G = (I4iin, Riaxi E), a play is an infinite sequence of vertices 
VqV-i V '2 • ■ ■ £ V u such that vg = vj, and (vi, Uj+i) £ E for all i ^ 0. We say that a prefix vg ■ ■ ■ of a play 
belongs to Min (respectively, Max) if Vk £ I4iin (respectively, Vk £ I4iax)- A strategy for player p is a mapping 
a from prefixes of plays belonging to p to vertices such that (vk, o’(vg ■ ■ ■ Vk)) £ E for all prefix vg ■ • • Vk belonging 
to p. The outcomes of a strategy a of player p are all plays VgV 2 • • • such that for all Vg • • ■ Vk with Vk £ V p , 
Vk- i-i = cr(v o • • • Vk). We write Play(G) the set of plays in G (we omit G when it is clear from the context), Play(a) 
the set of outcomes of a strategy <r, and Play(aMin, ^Max) the only play contained in Play(aMin) D Play( UMax)- 
Since we are dealing with quantitative game, we use a value function to map plays to values in R = Rl±l{+oo}. 
A quantitative game is a pair (G, /) consisting of an arena G and such a value function /. Most standard value 
functions are defined by using the weights in the weighted arena: equipped of one of the cost functions /: —»• M 

described in the main part of the article (Inf, Limlnf, Sup, LimSup, Avg, or DSa for instance), we may define a 
value function f w by setting f w {vgV 2 • • •) = f(w(v o, Vi)w(vi,V 2 ) • • •) for all plays VgVi 

In a quantitative game (G,/), the value of a strategy <TMin (respectively, CMax) of Min (respectively, Max) 
is: 

Val((G,/), o-Min) = sup /(tt), Val((G,/), o-Max) = inf /(tt). 

7rePZoy(tT M i„) vePlay{a m ^) 

To characterise the best value that each player can guarantee no matter what the opponent is doing, we consider 
the upper value Val (the best Min can hope for) and lower value Val (the best Max can hope for), defined by: 

Val(G,/) = inf Val((G,/),CTMin), Val(G,/) = sup Val((G,/), o Ma x). 

CTMin CTMax 

► Proposition 12. In quantitative games, for all the value functions f w obtained by considering the cost functions 
/ used above, upper and lower values coincide: we then let Val(G, /) = Val(G, /) = Val (G, /) be the value of 
the game. 


Proof. We rely on Martin’s determinacy theorem for Blackwell games HE since all the cost functions considered 
are Borel measurable. ◄ 
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B. 2 Encoding of quantitative sabotage games 

Starting from a QSG Q = (V, E, B, vi, Si, /), we encode it in the quantitative two-player game [<?] = ((Vmuo ^Max) 
E c ,w,Vj), f' w ) as follows: 

“ ^Min = ^ x A(Q), ^Max = ^ x A(G): Min vertices represent configurations of Q (i.e., the vertex of Q 
currently occupied by Runner, together with the current budget distribution), and Max vertices encode the 
last edge played by Runner in Q and again the current budget distribution; 

^ E c = {((v,S),{e,S)) | e = {v,v') £ E} U {((e,<5), (v',6')) \ e = (v, v') A S t> <5'}; 
h for all e = ( v , v') £ E and <5, S' £ A(G) we let w((v, 5), (e, ^)) = 5(e) and 

- w((e, 5), (V, S')) = 0 if / = DS a , 

- w((e,S),(v',S')) = 5(e) otherwise; 

h Vj = (vi, Si) is the initial configuration; 
h if / = DSa, we let f = DS^, otherwise f = /. 

We claim that Q and [C/] are equivalent, meaning that they have the same value. The main difference lies in 
the way costs are computed. Indeed, consider a pair of consecutive moves from both players in the original QSG 
Q, i.e., the traversal of an edge e = ( v,v') by Runner, followed by a budget redistribution S [> S' by Saboteur. 
Observe that this pair of moves incurs a cost of S(e) in the original QSG, but is encoded by the traversal of two 
consecutive edges ((v,S),(e, 8 )) and ((e, (5), (v’, 8 ')) in [(?] that have both weight 5(e) (or weight 8 (e) and then 
weight 0 for the discounted sum case). Observe however that this is not a problem for the cost functions that 
we are considering. Indeed, Sup, Inf, LimSup, and Limlnf are resistant to stuttering. The value of the average 
cost is also consistent, since both the sum of the visited weights and the length of the paths are doubled in [£/] 
with respect to G ■ For the discounted sum, this is taken care of by replacing the original discount factor A in G 
by a/A in [£]. 

C Proofs of Section [ 3 ] 

C. l Reduction from ABF to ESPr. proof of Lemma [4] 

In this section, we fix an instance of the ABF problem, i.e., a CNF formula $ and an initial configuration 
(valo, Player 0 ). We let N be the number of variables in <F. We construct an extended QSG Q such that Saboteur 
wins in the extended safety problem over Q if and only if Prover wins the ABF game. Therefore, Saboteur 
will act as Prover while Runner will act as Disprover. As an example of our construction, we consider the 
CNF formula of Example [3| Recall that in extended QSGs, we allow for the use of safe edges, i.e., edges where 
Saboteur cannot put budget, and final vertices, i.e., vertices where the play ends, with the budget placed on 
this vertex taken into account to compute the cost. We present step by step the vertices contained in Q. For 
every variable X , we create 4 final vertices Ver(X) = {-cX^ 1 ), -uY^, X^\ X^ }. We also create another final 
vertex called a. In the following, we always assume that edges are safe, unless explicitly stated. 


Forcing to have at least budget 2 on Ver(X) 

For each variable X, and each triplet t = {ui,U 2 ,U 3 } C Ver(X), we create two vertices, t W and t^ such that 
in the graph, ; f ( 2 )) ; (t^ 2 \vi) £ E for all i £ {1,2,3}. Note that if there is zero budget on the triplet t when 
Runner arrives in t^\ then Runner is sure to reach one of the Vi without visiting edges with non-zero budget 
(and hence win the game). For all vertices v in the graph (except those in the initialisation gadget, as we see 
later), all variables X and all triplets t as described above, we create an edge (v, t). If at some point in the game 
there is a variable A' such that there are less than 2 vertices in Ver(X) with a budget on them, then Runner is 
sure to win the game. This gadget is depicted in Figure [3j In the following, we assume that Saboteur always 
place at least 2 units of budget on each Ver(A'). We also assume that if it is the case, then Runner does not go 
on a t vertex (indeed he will be sure to lose the play if he does so). Saboteur always places at least 2 units of 
budget on each Ver(X). We also assume that if it is the case, then Runner does not go on a t ^ vertex (indeed 
he will be sure to lose the play if he does so). 

The budget in the game is B = 2 N + 1. Let v be a vertex that has an outgoing edge towards a. When 
Runner leaves v, in order for Saboteur not to lose, there must be one unit of budget on a and exactly 2 units 
of budget on each Ver(A). 
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Forcing the budget to be well distributed 

Now we present another gadget that allows Runner to force, on some vertices, that (*) either ->Xd) and 
->Xhave one unit of budget each, or X^ 1 ' and have one unit of budget each. To do so, for each pair 
p = we construct a vertex p that has two outgoing edges, (p, ->XW) and (p,X^). Let v be a 

vertex that has outgoing edges toward each of those p vertices. When Runner leaves v, if property (*) is not 
fulfilled, then there is a pair p = X^} with zero budget on it. By going on p, Runner ensures to reach 

one of those vertices without budget, hence to win the game. We let Check(X) be the set of all those vertices 
associated with X , and we will describe later which vertices have outgoing edges toward Check(X). This gadget 
is depicted in Figure [4] When Runner leaves a vertex v with an outgoing edge toward Check(X ), we now assume 
that Saboteur has made true property (*) for A', so that Runner never goes to Check(X) (indeed he will be 
sure to lose if he does so when (*) is fulfilled). 

Let v be a vertex that is connected to a and to all vertices of Check(X) for all X (we let Check = 
\JxeVar Check(X)). When Runner leaves v, in order for Saboteur not to lose, there must be one unit of 
budget on a, and one unit of budget either on ->XW and -,X^ 2 \ or on A'W and X^ 2 \ for all A. We call 
such a configuration a valid one, and remark that there is an immediate bijection from valid configurations and 
valuations of the variables of the CNF formula. We call a valid vertex a vertex connected to a and to Check. 

Initialising the game 

We add a gadget, at the beginning of the game, forcing Saboteur to distribute the budget accordingly to 
the initial valuation valo of the ABF game. The gadget works as follows: Runner crosses 2 N + 1 safe edges 
successively, and then goes on a vertex v that has edges towards each vertex of the required initial configuration. 
Saboteur has the time to put the required units of budget on this configuration, and is forced to do so, otherwise 
Runner would be able to reach a final vertex. Therefore, we are sure that once this gadget is left to start playing 
the game, the configuration is indeed the required one. From vertex v, there is also another safe edge going 
either to the vertex Play or to the vertex set ^ (the role of both vertices is explained later), depending on 
whether Player 0 is Disprover or Prover, respectively. 

Structure of the graph 

From the CNF formula of Example [3j we construct the graph depicted in Figure [5| For the sake of clarity, 
we omit the gadgets introduced above. Double bordered vertices represent final vertices, and double arrows 
represent safe edges. As stated above, from all vertices depicted here, gadget of Figure [3] is used to check that 
Ver(X) contains at least budget 2, for all variables A. The subscript in {A, B,C, D, a} on vertices depicts an 
edge from the vertex to the corresponding gadget Check , or vertex a. 

Saboteur modifies Prover’s variables 

The two safe vertices set W and set^ describe Prover’s turn to modify one of its variables. Both vertices have 
an outgoing edge towards a ensuring that one pebble is left on it. set ^ is a valid vertex, and seC 1 ' 1 is connected 
to Check(X) for all variables A belonging to Disprover. Finally, there is an edge (set^\ set' 2 }) connecting 
those two vertices. 

Let v be a valid vertex with an outgoing edge set W and let vaR be the valuation of variables induced by a 
valid configuration at the moment Runner leaves v. If Runner goes to the vertex set ^ and then to set^ 2 \ let 
vaR be the valuation induced by the valid configuration at the moment Runner leaves set^ 2 \ We claim that 
between vaR and vaR, at most one variable of Prover has been modified. Indeed after Runner has arrived in 
set' 1 ', Saboteur cannot remove the budget on a, and he cannot take the budget on some Ver(X) to put it on 
another Ver(A'), with X' ^ A, as there would be only budget 1 on Ver(X) and Runner would win. Therefore, 
the only possible move for Saboteur is to redistribute the budget inside some Ver(A). Moreover, if A belongs 
to Disprover after a move, Ver(X) will not satisfy the property (*) and, since set W is connected to Check(X), 
Runner would win. Therefore, either Saboteur does nothing, or he redistributes the budget inside some Ver(X) 
where A belongs to Prover. If he has done nothing then after Runner has gone to set^ 2 \ by the same reasoning, 
and by the necessity that at this moment the configuration is valid, one can ensure that again Saboteur does 
nothing, in which case we would have vaR = vaR. Let us focus on the case where Prover has performed some 
redistribution in Ver(X). Without loss of generality, assume that when leaving v, the budget was placed on 
XW and A'( 2 \ and after leaving set W the budget is on -iX^ and X^ 2 ). By the same reasoning, we know that 
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after reaching set^ 2 \ Saboteur can only redistribute the budget inside a Ver(X') where X' belongs to Prover. 
Furthermore, if X' X then, when leaving set^ 2 \ Ver(X) would not satisfy (*) and the configuration would 
not be valid. Therefore Saboteur can either choose to have the budget on A^L and X^ 2 \ or on and 

~^X( 2 \ therefore between val 2 and vali only the valuation of X may have change. 

Runner modifies Disprover’s variables 

From the vertex Play , Runner chooses a variable X of Disprover, and goes either to set ^ or to setp 1 : assume 

without loss of generality that he goes to setp*. Those two vertices have outgoing edges toward a and toward 

Check(X') for all X' ^ X. Let vali be the valuation associated with the valid configuration when Runner 

leaves Play. After arriving in setP, Saboteur can only redistribute the budget inside Ver(A'). After arriving 

in set x , Saboteur is forced to reach a valid valuation, therefore if he has modified the budget distribution in 

Ver(A), he must do it again in order for Ver(A) to satisfy (*). Furthermore, as set x has outgoing edges to 

the two final vertices A^ and A'^ 2 ), there must be a unit of budget on each of those vertices. Therefore, if we 

(2) 

let val 2 be the valuation induced by the valid configuration when Runner leaves set x , val 2 must be equal to 
vali except possibly for A that must now be true. 

Verifying a valuation 

Before explaining the whole behaviour of the game, let us describe the verification process. As Verif is a valid 
vertex, when Runner leaves this vertex, the configuration is valid: we therefore let val be the valuation induced 
by this configuration. We show here that, from the moment Runner leaves Verif, Saboteur has a winning 
strategy if and only if val satisfies the CNF formula. Let us first describe this part of the arena. 

Verif has one outgoing safe edge toward each vertex Xi associated with the eponymous clause. Those vertices 
are connected to Check. Take a clause Xi = a ti A • • • A atz. For each strict suffix of this clause containing at 
least two atoms, i.e., for each sub-clause of the form atj A • • • A at? with 1 < j < £, create an eponymous vertex. 
Then \i has a safe edge toward at !'] 11 and a (non safe) edge toward the rest of the clause, i.e., nothing if t = 1, 
( 2 i.y 1 if £ = 2, and the vertex l at 2 A • • • A at if if t > 2. The same principle applies to the vertex l af 2 A • • • A at/, 
etc. For example, take Xi i n the CNF formula <J>. The vertex Xi has edges toward -> A ^ and toward the vertex 
‘BV -<C' which is the rest of the clause. Then the vertex ‘BV has an edge toward BV) and an edge toward 

-.gw. 

Assume first that val satisfies the formula, and let us see how Saboteur has a winning strategy. When 
Runner reaches a clause Xii we know that it is true in val, i.e., that one of its atom is true. On the game, this 
is represented by the fact that one of the atoms atj has non-zero budget on the two associated vertices at j 1 -* 
and atp. For example assume that Runner goes to Xi and that B is true, i.e., there is some budget on B W 
and B 1 ' 2 ' 1 . Saboteur will use the budget on a to guide Runner in direction of this atom. In the example, when 
Runner reaches %i, Saboteur will put the budget on A^\ then when Runner will go to ‘BV ~<C’, Saboteur will 
move the same unit of budget on —*C^\ forcing Runner to go to However, as there was already some 

budget on B^\ Runner cannot leave l B V ->C’ without touching some non-zero budget, and loses the safety 
game. 

On the other hand, assume that val does not satisfy the formula and let us see how Runner has a winning 
strategy. As the valuation does not satisfy the formula, there exists a clause Xi that is false. Runner goes to this 
clause. As it is false, all the atoms are false, in particular, in the game, for all atj, there is budget 0 on at 1 :- 11 . 
Runner will have the following behaviour. If, after reaching Xi> Saboteur has not put some budget on atp, 
then he goes there and wins, otherwise he goes to the vertex representing the rest of the formula. From there, 
the same reasoning applies: if Saboteur has not put some budget on at!p, then Runner goes there and wins, 
otherwise he reaches the next sub-clause. At the end, Runner reaches the vertex ‘atp l V atp\ and whatever 
Saboteur does, Runner reaches a final vertex with budget 0. 

How the game works 

When Runner leaves vertex Play, the configuration is valid; once he reaches set W, the configuration is valid 
again, and the difference with the previous one is that the valuation may have changed for at most one variable. 
Once reaching Choose, Saboteur may also have changed the valuation of one of its variables. When Runner 
reaches Choose, Saboteur can only redistribute the budget on a. One can easily see that he has no interest in 
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changing the valuation by putting some budget in Ver(X ) for some variable X, as at the next step he must put 
the budget back on a. However, Saboteur can either put the free unit of budget on the edge (Choose, Play), 
forcing Runner to go to the verification part on the game, or put it on the edge ( Choose, Verif), forcing Runner 
to remain in the part of the game where they change the valuation. If Saboteur has a winning strategy in the 
ABF game, he will apply it, and once the valuation satisfies the formula, he will force Runner to go to the 
verification part. On the other hand, if the formula is never true, Saboteur is forced to prevent Runner from 
going to the verification part (otherwise Runner would reach a final vertex as seen above), and the game will 
last forever, allowing Runner to win. 

► Example 13. Consider the formula given in Example [3] i.e., d> = Cl\ A Ch A CI3 A Cl 4 where Cl\ = A\J ->C, 
Cl 2 = C V D, CI3 = CV ~^D and CI4 = BV ~<B. The ESPr constructed from is given in Figure [ 5 ] Notice that 
besides the variable vertices, there is one extra final vertex, a. In this construction, Saboteur plays the role of 
Prover, whose variables are C and D, and Runner the one of Disprover whose variables are A and B. 

For the sake of clarity, edges pointing towards a, as well as the two gadgets of Figures [3] and [4] are omitted. 
Consider that from all vertices but the variable ones, one can check condition (I) for all variables, i.e., in 
order not to lose, Saboteur maintain a non-zero budget on at least two vertices from Ver(x) for all variable x. 
Furthermore, on the bottom right corner of nodes are written the variables for which one can check condition 
(ii) and whether there is an outgoing edge pointing towards a, e.g., when Runner is in vertex set) 1 ^, Saboteur 
must ensure that A and B satisfy condition (ii) and that there is a non-zero budget on a. In the following, 
we consider those gadgets as constraints, considering that condition (i) always holds, and for example that if 
Saboteur is in set ^ we are sure that (ii) holds in A and B and that there is a non-zero budget in a. 

If we let n be the number of variables (here n = 4), let us set the budget to 2n +1 = 9. In this context, each 
Ver(x) contains 2 units of budgets, and the remaining unit can be either on a, on the outgoing edge of Choose, 
or on one of the variable vertices. 

The initialisation gadget ensures that after some preliminary steps, Runner reaches vertex Play, and there 
is one unit on a, and for each variable there are exactly two units of budget either on {—} or on 
x^}, depending on the initial configuration of the ABF game. 

Let us now focus on the upper part of the game. When Runner is on vertex Play, condition (ii) must be 
satisfied for all vertices, and there must be one unit of budget on a, therefore the budget describes a valuation 
of the variables, e.g., on Ver(A) either the two units of budget are on {-la^ 1 ), —'Oa^ 2 - 1 } in which case we consider 
that A is false, or on {a^ 1 ), x^} in which case A is true. Assume that A is false, and Runner wants to change 
its valuation. Then, he goes to set^ where Saboteur has the possibility to move one unit of budget in Ver(A), 

/q\ 

and then he goes to ser A . In this configuration condition (ii) must be satisfied for A. Furthermore if the two 
units of budget are still on (VA) 1 ), -^A^ 2 ' 1 }, then Runner wins by going on A^\ thus Saboteur has been force to 
switch the two weights on {A^l, A^l}. Then, a similar process allows Saboteur to modify the valuation of one 
of its variables, when Runner goes through set^ and set Those steps simulate one round of the ABF game. 

On vertex Choose, Saboteur may remove the budget on a and put it on one of the outgoing edges of Choose, 
thus he can force Runner to go either on Play or on Verif. If Play is chosen, both players will simulate another 
round of the ABF game. If it is Verif, then Runner goes to the lower part of the game. 

In this part, Runner chooses a clause and then Saboteur can move the unit of budget that were on a. For 
example, assume that Runner chooses Cl 1 . As there were a unit of budget on A^\ Saboteur can take the 
budget of a to put in on —iC^ ensuring to win. Observe that the verification part of the game ensures that 
Saboteur wins if, for each clause, at least one of the atoms is true. Indeed if it is the case, whatever clause is 
chosen by Runner, Saboteur will be able, as seen above, to prevent Runner to play. On the other hand, if there 
is a clause where both atom are false, it means than both outgoing edges point towards empty final vertices, 
therefore whatever Saboteur does on the next step, Runner will be able to reach one of them, and thus win the 
game. 

C.2 Reduction from ESPr to SPr: proof of Lemma [5] 

We describe how to transform an extended QSG into a regular QSG. The transformation rids the original 
sabotage game of its safe edges and final vertices, and replaces them with corresponding gadgets with the same 
properties. 

Final vertices are replaced by the gadget shown in Figure [6a] More formally, all edges incident in a final 
vertex are replaced by edges incident on a copy of the gadget. A is the entry point of the gadget, i.e., any 
edge pointing towards the final vertex in the extended QSG would now lead to A. Vertices C\ and C2 are both 
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connected to oq, for all 1 ^ i ^ B + 1, and the af s form a clique of size B + l. It should be clear that, if Runner 
reaches one of the oti, then he can ensure that the value of the play, from then onwards, is exactly 0. Indeed, as 
there are B + l outgoing edges, at least one of them has no budget on it; if Runner crosses this edge, he reaches 
another aj where the same property holds. Thus, one can easily see that when Runner reaches A, he can win 
if and only if there is no budget on either one of the edges: (A, G\), ( A , C 2 ). 

Safe edges can be encoded as follows. Assume that we have a safe edge (A,C) in the extended QSG. To 
encode it in a standard QSG (with final vertices, as we have already seen how to encode them), we add B + l 
vertices E\, ..., Eb+ 1 , and B+l final vertices Fi,..., Fb+ i- We remove the edge (A, C), and add the edges 
(A, F,), (Ei,Fi) and (Fj,F), for all i + B + 1. The gadget is depicted in Figure 6b Runner has a strategy to 
go from A to C without crossing an edge with non-zero budget, and forcing Saboteur to move at most one unit 
of budget inside the game. That is to say, we have introduced one additional step to get from A to C, but we 
will see that Saboteur cannot move more than one unit of budget on edges outside of the gadget, or he loses. 
Indeed, when Runner leaves A, there must exist i such that there is no budget on edges (A, FQ, (Fj, Fj), (Fj, C) 
nor on the final vertex Fj. If Runner goes to Fj, Saboteur must take a unit of budget and put it either on 
(Fj,Fj) or on Fj, otherwise Runner can reach F, and win. Now, Runner is able to reach (7, and then Saboteur 
can redistribute the budget as he wants. 


C.3 Reduction from ThPri sup f un ( 0) to SPr. proof of Lemma [ 7 ] 

Consider an instance I of the safety problem with underlying graph G(T) = (V,E), budget B , and a starting 
vertex vj. We build a QSG Q' with graph G' = (V',E'), initial vertex ti, budget B\ and cost function LimSup 
as follows: 

B' = \E\, 

V' = VU{si | l^i^B' + l,l<j <B'}U{x m | B + 

U {f k | 1 ^ k < B} U {eg | 1 < l < B + 1} , 

F' = FU{(e i ,/j) | 1 < i < B + 1,1 < j < B} U {(/*:, e fc ), (f k ,e k +i) | 1 < k < B} 

U{(a -g,t m ) | l<m<2,B + l<*<B'}U{(£ m ,«f) | 1 < i < B' + 1,1 < m < 2} 

U{(«i‘,4 _1 ) I ^F , + l,2<i^F , }U{(4,e m ) | 1 < m < 2,1 < * < B + 1} 

U {(e m ,u) | 1 ^ m ^ B + 1, (vj, u) £ F} U {(u, xg) \ u £ V, B + 1 ^ i ^ B'} 

U {(e m , xe) | l^m^B + 1, B + l^£^ B'} . 

Intuitively, the sub-graph of G' defined by the vertices e,; and fj form an initial gadget which ensures that 
Runner can stay out of G(I) without paying, as long as there is some weight assigned to edges from F. We 
also add an exit gadget consisting of the sub-graph of G' defined by the Xk vertices. These allow Runner to exit 
from G{I) if Saboteur “cheats” by assigning more weights to edges from F than the original bound B. Both 
gadgets are linked by a “safe path” formed by the vertices sj. Note that we add sufficiently many sj so that, 
for Runner, getting from any sf to any sj is always possible without traversing a weighted edge. 

We prove that Runner wins in I if and only if Val(t/') ^ 0. 

Assume first Runner wins I. In Q 1 , he has no trouble following a path from t\ through the uj until he 
arrives on some u\ with budget distribution wq such that vj 0 (uJ , e,j) = 0, for some 1 ^ j ^ B + 1, since there 
are B' + 1 vertices at each level of the safe path. On his next turn, he can then move to such an e ? . As long 
as the budget distribution has some budget assigned to some edge of F, there exists a vertex e^. or x£ with no 
budget on either in-edges or out-edges, respectively. In the first case, Runner can go to such such an e*, via 
fk without paying anything. In the second case, Runner can get to t\ or f 2 via X( and repeat the process, all 
without paying. When the budget distribution has no weight assigned to edges of F, Runner can follow his 
strategy from I - with the exception that he plays his first move from ej instead of Vj - as long as Saboteur 
keeps at most B budget units on edges of F. When this is no longer the case, say Runner is on a vertex u, with 
budget distribution uq, that means there are at most B' — B — 1 budget units on other edges, hence there is a 
vertex xt such that wi(u, xf) = W\(xg, t±) = w±(xg, £ 2 ) = 0. Runner then moves to xg. On his next turn, he can 
then move to either t\ or £ 2 , following an edge with no weight on it. Then Runner can restart this strategy. 

Assume now, that Saboteur wins I. From the start of the game, Runner will have to traverse one sj for all 
j from B' to 1. When Runner is on a vertex sj for j between B + l and B' , Saboteur puts a budget unit on the 
edge (xj,ti) and leaves it there. Similarly, when Runner is on a vertex w[ for j between 1 and F, Saboteur puts 
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a unit of budget back on the edge ( fj,ej ) and leaves it there. When Runner finally reaches some efc, Saboteur 
passes. Then, if Runner goes to fg or x m , Saboteur can assign some budget to (fg,eg+ 1 ) or (x m ,t 2 ) and put 
it back where it was after Runner’s next move, where he will inevitably cross a weighted edge, then wait until 
Runner gets back to some efc. Alternatively, from e*,. Runner can move to a vertex in G(I). In this case, 
Saboteur follows his strategy from I, using budget units assigned to edges of the form ( fk,&k ) when needed, 
until Runner crosses an edge of E with some weight on it or gets to some xg. In the latter case, Saboteur can 
react the same way as if Runner was coming from efc. In the former case, Saboteur can start putting some 
weights on all edges of E until Runner gets to some xg. If Runner never does, he will pay one at each step, 
which is enough for Saboteur. Otherwise, Runner goes to some xg, then to t\ or O, where Saboteur can restart 
his strategy. 

D Proofs of Section [ 4 ] 

D.l Static threshold problem for Inf and Limlnf is in PTIME: proof of Lemma |10| 

For Inf, we claim that Val sta t(f?) = U-®'|/-SJ> where E is the set of edges reachable from vi. Indeed, for a given 
budget distribution S, Runner simply goes towards the edge reachable from vj with the least budget possible; 
therefore, Saboteur must place equal budget on each such edge. With a budget B , he can ensure U£|/-BJ on 
every edge (some edges may contain a bigger portion of the budget, but some edges will always have at most 
\\E\/B\). Hence, deciding the static threshold problem for Inf amounts to computing the set E (can be done 
in linear time with a depth-first-search algorithm), and checking whether \E\ ^ B x (T + 1). 

For Limlnf, we must refine the study by considering strongly connected components. Precisely, we claim 
that Val stat (S) = [\E\/B \, where E is the set of edges reachable from Vj and contained in a strongly connected 
component of the graph. Indeed, for a given budget distribution <5, Runner simply goes towards a cycle reachable 
from V] containing an edge with the least budget b possible: he will visit infinitely often this edge, ensuring an 
inferior limit at most b. Such a cycle is included in a strongly connected component, and reciprocally, every 
edge of a strongly connected component is part of a cycle. Hence, Saboteur must secure equal budget on each 
edge of every strongly connected components. Then, deciding the static threshold problem for Limlnf amounts 
to computing the set E (can be done in linear time, e.g., with Tarjan’s algorithm), and checking whether 
\E\^Bx (T+ 1). 

D.2 Static threshold problem for Sup, LimSup, Avg and DS is coNP-complete: proof of 
Lemma ITT! 

For the membership in NP, we can first guess a budget distribution S (that is of size polynomial), and then 
compute the value of the one-player (since player Max has no choices anymore) quantitative game Qs, to check 
if it is greater than T: computing the value of such a game can be done in polynomial time for the four cost 
functions we consider (see [I]). 

To prove the NP-hardness for cost functions LimSup and Avg, we give a reduction from the following problem. 
The Feedback ARC set PROBLEM consists in, given as input a directed graph G = (V , E) and a threshold 
k ^ \E\, determining whether there is a set E' of k edges of G such that (V,E\E') is acyclic. Karp showed in 
m that the feedback arc set problem is NP-complete. 

We now use the feedback arc set problem to prove the results of coNP-hardness of the static threshold 
problem. Let us consider an instance of the feedback arc set problem, given by a directed graph G = ( V , E) 
and a natural integer k ^ \E\. We suppose, without loss of generality, the existence of a vertex vi, without any 
in-going edges, and linked with an edge to every other vertex: since vg is not included in any cycle, the set E' 
of the output of the problem has no interest at containing any of the edges added in this way. 

We then construct a QSG Q = (V, E,k,vi, f) with / £ {LimSup, Avg}. It is not difficult to show that 
Val 8ta t(£0 > 0 if and only if there exists a set E' of k edges of G such that (V,E \ E') is acyclic. Indeed, 
Val s tat(&) > 0 implies that there exists a distribution S £ A (Q) such that for all strategies p of Runner, 
f(TTp J > 0. Noticing that every vertex is reachable from the initial vertex uj, and considering memoryless 
strategies of Runner (such that 7 r s p L ends with a simple cycle of the graph), we show that every cycle contains at 
least one edge with a non-zero budget. The set £1' = {e £ JT | A(e) > 0} is then a valid output for the feedback 
arc set problem. For the reciprocal implication, we simply assign a budget 1 to each vertex of the set E'. 

The result for Sup and DS is then obtained by a slight modification of the previous proof. Let Q_ = 
(V, E, k, vi, Sup) be the QSG obtained from Q by transforming every edge (vi, v) into a safe edge (see Lemma[5]). 
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Without loss of generality, we can now assume that 5 never assigns budget to the edges E\E. We also note that 
vi has no in-going edges so that every play in Q traverses a safe edge at most once. We claim that Val sta t(£) > 0 
if and only if there exists a set E' of k edges of G such that (V,E \ E') is acyclic. Indeed, if Val sta t(0 > 0, 
considering E' = {e £ E \ 5(e) > 0}, it is easy to show that (V, E \ E') is acyclic: if not, Runner may simply 
jump from uj, with a safe edge, to one of the vertices of a cycle of (V, E\E'), and then loop in this cycle forever, 
without visiting any edge with non-zero budget. For the reciprocal implication, again, it suffices to assign a 
budget 1 to each vertex of E'. The result for DSa follows from the same reduction together with Lemma [6] 

E Towards more expressive sabotage games 

In this section we increase the expressiveness of the definition of sabotage games, and show that the threshold 
problem for these new games are still in EXPTIME. The lower bound is immediate since they are extensions of 
previous problems shown EXPTIME-hard in the rest of the article. 

One can see a sabotage game as a system in which a controller tries to evolve while avoiding as much as 
possible the weights put by Saboteur. The vertices of the graph represent configurations of the system, edges 
represent the actions, and the budget of the Saboteur may represent several problems that can occur during the 
execution. For example, it may describe a number of failures that can happen at the same time, or in a much 
quantitative way, it may represent how much some elements of the systems are overload, and then how much it 
would cost, in terms of time or energy, to use them. 

We propose to look at sabotage as a particular semantics of systems. Based on the observation of Appendix[B] 
remember that one can define the semantics of a QSG Q = (V. E, B , uj, <5/, /) as a quantitative two-player game 
[£/]. If we split the model (the graph G = (V. E) with initial vertex vi), from the sabotage parameters (budget 
B > 0, initial distribution <5/ £ A (E,B), and cost function /), we can define: 


lG] BtSlJ = l(V,E,B,v I ,6 I ,f)j. 

We have seen that the value of the QSG (V, E , B , uj, 5i, f) is identical to the value of the quantitative two-player 
game |G]b, 5 ,,/- 

From a model point of view, graphs—which can be viewed as one-player games with trivial winning 
conditions—are quite limited. In more realistic models, we may be interested as modelling systems with un¬ 
controllable actions (i.e., as two-player games), and where the controller has a specific Boolean goal to achieve, 
instead of simply visiting the graph ad vitam <eternam. A more realistic goal is usually expressed via LTL for¬ 
mulas, that can be modelled into qualitative games with parity winning conditions, as we show in the following. 

E.l Qualitative two-player games 

As a complement of the quantitative two-player games defined in Appendix [B] we now focus on qualitative 
two-player games games. Consider a weighted arena G = (Wiin ; Wiax) E.w.Vj) as before. In the qualitative 
setting, we are no longer interested in associating a value to each play (in particular, the weight function w is of 
no use here), but simply stating whether a play is winning or not for a player. Formally, a winning condition is 
a subset of V u containing the set of winning plays. A qualitative game is a pair (G, G) consisting of an arena G 
and a winning condition G. A play 7r is declared winning for Min (respectively, for Max) if 7r £ G (respectively, 
7r ^ G). A strategy a p of player p is winning for p if all plays 7r £ Play(a p ) are winning; a play/strategy is losing 
for player p otherwise. We say that player p wins (respectively, loses) the game if he has (respectively, does not 
have) a winning strategy. Here are some usual winning conditions considered widely in the literature: 

b for all F £ V or F £ E, Reach(F) is the set of plays that contain an occurrence of F. 

_ for all F £ V or F £ E, Safe(F) is the set of plays that do not contain any occurrence of F. 

h for all F £ V or F £ E, Biichi(F ) is the set of plays that contain infinitely many occurrences of F. 

h for all F £ V or F £ 15, coBiichi(F) is the set of plays that contain only finitely many (possibly none) 

occurrences of F. 

h for all Col : V —> N (such mapping is called a colouring function ), Parity(Col ) is the set of plays UoUi • • • 
such that the greatest colour appearing infinitely often in the sequence CoI(vq), Col(vi), ... is even. Given a 
colouring function Col , we let \Col\ be the number of different colours of the vertices, i.e., \Col\ = \{Col(v) \ 
v £ V}\. 

h for all value function /, and T £ R, Threshold^ (f,T) is the set of plays 7r such that /(7r) ^ T. 
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► Proposition 14. Qualitative two-player games with all winning conditions considered above are determined, 
i.e., one player is winning if and only if his opponent is losing. 

Proof. Martin’s determinacy theorem m applies here since all the above mentioned objectives are Borel 
sets. ◄ 

E.2 Sabotage in parity games 

In order to apply a sabotage semantics to qualitative game, where Min wants to satisfy a condition while 
minimising a cost, one must study some mixture between qualitative and quantitative aspects. We see how 
one can combine winning conditions and value functions, as introduced in [3]. Intuitively, in a weighted arena 
G = (I4iin, 14iaxj E,w,vi) with a winning condition C and a value function /, Min could want to satisfy C 
while minimising /. We formalise this by building a new value function, denoted by C A /, and defined by 
C A f(n) = +00 if 7r ^ G, and C A f(n) = f(n) otherwise. The quantitative two-player game (G, C A /) now 
contains the combination of both objectives. 

We may finally introduce a sabotage semantics for parity games. Instead of deciding whether a player has 
a winning strategy, which would be a standard semantics, we decide whether he has a winning strategy that 
guarantees (or simply avoids in the case of a threshold 0) a certain threshold over the quantity of penalties 
when the game is subject to failures. 

Formally, given a two-player parity game G = ((I4tin>^Ma E,vi), Parity(Col)), a budget B > 0, an ini¬ 
tial distribution <5/ £ A (E,B), and a cost function / £ {Inf, Limlnf, Sup, LimSup, Avg}, the B, 61 , f-sabotage 
semantics of G is the quantitative game 

[G]b,< 5/,/ = ((^Min, Ktax > E ', w, vj), Parity (Col') A f w ), 
where : 

“ ^Min = ^Min x A(E,B), and I^ax = (^Max x A (E,B)) l±l (E x A (E,B)): with respect to the one-player 
case of Appendix [B] we add some vertices to player Max that has now in charge both the moves of the 
environment (uncontrollable actions), and redistributions of Saboteur; 
b E' = {((u, <5), (e, S)) | e = (v, v') £ E A S £ A (E, B)} U {((e, (5), (v\ S')) \ e = (v, v') £ E A 5 > <5'}; 

- w((v, 6 ), (e, 5)) = w({e, S), (v', S')) = S(e); 
h vf = ( Vi , Si) is the initial configuration; 

- Col'((v,v'), 6 ) = Col'(v', S) = Col(v'). 

To simplify our study, we do not consider the discounted-sum in this section. The threshold problem, describing 
the cost that player Min can ensure, is then defined as previously. 

► Definition 15 (Threshold problem for cost function /). 

Input: A parity game (G, Parity(Col)), a budget B , an initial distribution Si £ A (E, B), and a threshold T, 
Output: Is there a strategy a of Min such that Val([G ]b , Sl ,f,<T)<n 

We are able to show that, even with the extension, the threshold problem stays in EXPTIME. 

► Theorem 16. The threshold problem for cost functions Inf, Limlnf, Sup. LimSup and Avg is in EXPTIME. 

To prove this theorem, we first establish a crude (but sufficient) upper bound on the complexity of solving 
quantitative games obtained by combining parity winning conditions and the previous cost functions. 

► Proposition 17. There exists three polynomials Pi,P 2 ,P 3 such that we can decide the threshold problem 
of any quantitative game (G, Parity (Col) A f w ) with / £ {Inf, Limlnf, Sup. LimSup, Avg} with a complexity in 
0(pi(\w\) ■ p 2 (\V\) p ^ Col \'>). 

Proof. We start with the case / = Avg. In [221 [Tj it has been shown that one can decide who wins in a 
qualitative game with a parity condition with a complexity in 0(|I/| 2 +l Coi l). I n [23], it has been shown that one 
can compute the value of a quantitative game with an average cost function with a complexity in 0(|w| • |I^| 5 )- 
The combination has been studied thoroughly in [3]. There, it has been shown that if one can solve average cost 
games in ci(|IA|, |ty|) and parity games in C 2 (|V|, |Go?|), then one can solve games (G, Parity(Col) A Avg m ) with 
a complexity in 0 {\V\^(\V\ 2 + Ci(| V|, |w|) + C2(| W|, |GoZ|)). By combining this result with the two above, we 
obtain a complexity in 0((|iy| + l)|I7| 5 +l Goi l). 
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We then turn to the case / £ {Inf, Sup, Limlnf, LimSup}. Our proof goes by encoding / into a qualitative 
winning condition, and then using classical results of algorithmic game theory. Observe that deciding the 
threshold problem in the game (G, Parity(Col) A f w ) amounts to solving the following problem: 

Input: A weighted arena G = (VMin, Vm & E,w,vi), a colouring function Col , a threshold T € Q 
Output: Does Min have a winning strategy in (G, Parity (Col) 0 Threshold^ (f w ,T))l 

The crucial remark is that, if we let F = {e £ E \ w(e) ^ T}, we can rewrite the threshold sets for all payoff 
functions as follows: 

Threshold^ (\r\f w ,T) = Reach(F ), Threshold^ (L\m\nf w , T) = Biichi(F ), 

Threshold^ (Sup w , T) = Safe(E \ F ), Threshold^ (LimSup w , T) = coBuchi(E \ F). 

Notice that F is a subset of edges, and not vertices. However, it is easy to transform the problem into an 
equivalent problem where F is indeed a subset of edges. Informally, it suffices to enrich the vertex set by letting 
V' = V x {0,1}, letting (vi, 0) the initial vertex instead of vi, and replacing each edge (v, v') £ E by the set of 
edges in E 

- {((«> 0), (i/, 0)), (0,1), ( v ', 0))} if (v, v') £ F; 

- {((u, 0), («', 1)), ((„, 1), K, 1))} if („, v') £ F. 

Then, letting F' = V x {1} and Col'(v) = Col'(v, 0) = Col'(v, 1) = Col(v), allows us to keep track, in the 
vertices, of whether the last seen edge is in F or not. 

Now to conclude the proof, we describe two polynomials p\ and P 2 such that deciding if Min can win qualit¬ 
ative problem with a winning condition obtained by the intersection of a parity condition and another one from 
{Reach(F), Biichi(F), Safe(F), coBiichi(F)} with F C V can be done with a complexity in 0(pi(V) P2 ^ Co1 ^). 
We let G = (I4iin, VMaxj E, vi) the arena on which we play (the weight function is of no use anymore). 

For Reach(F) (respectively, Safe(F)), one can construct in polynomial time a parity game (G' = (V^j in , V^ ax , 
E' ,vi), Parity (Col 1 )) such that V C V', \Col'\ ^ \Col\ + 1, and Min wins in (G 1 , Parity (Col 1 )) if and only if 
Min wins in (G, Parity(Col) fl Reach(F)) (respectively, (G, Parity(Col) D Safe(F))). For Safe(F), we remove for 
each vertex v £ F every outgoing edge in F, and add a self loop, colouring them with an odd colour. Hence, 

if a play reaches such a vertex the play is losing, and otherwise, it is winning if and only if the greatest colour 

seen infinitely often is even. For Reach(F), we create two copies of the game. In the first copy, every colour is 
odd, and for every vertex v in F the outgoing edges are modified to go to the same target but in the second 
copy. In the second copy, nothing is changed. The play start in the first copy. In order to win, Min must go to 
the second copy (otherwise the colour will always be odd), i.e., must reach a vertex in F and then the greatest 
colour seen infinitely often must be even. As we have seen above parity games can be solved 0(\V \ 2+ ^ Co1 I) 
which concludes the proof for these cases. 

For Biichi(F) and coBiichi(F), there exist two colouring functions Col' and Col" such that: \Col'\ = |GoZ"| = 
2, Biichi(F) = Parity(Col'), and coBiichi(F) = Parity(Col"). Indeed, for v £ F, simply consider Col'(v) = 2 
and Col"(v) = 1, and for v ^ F consider Col'(v) = 1 and Col"(v) = 0. Therefore solving a game with a winning 
condition of the form Parity(Col) D Biichi(F) or Parity(Col) (~1 (co)Biichi(F) can be turned into solving a game 
with a winning condition of the form Parity(Col) D Parity(Col') with \Col'\ ^ 2. Such games have been studied 
in [1]. They have shown that they can be solved with a complexity in 0(|V| + 2) 5 ^ Col ^ +2 ^ ), which concludes 
the proof of the proposition. ◄ 


We can finally establish the complexity of solving sabotage parity games. 


Proof of Theorem 1161 From a parity game (G, Parity (Col)), a budget B, an initial distribution 5i, and a 
threshold T, one can construct [G]b, 5 /,/ = ((^Mini^Ma E',w,vj), Parity(Col') A f w ) in exponential time. 


Proposition 17 shows that we can decide who wins from (vj,Sj) in this game with a complexity in 0(jpi(\w\) ■ 

P2m) M\c^)' 

We have \w\ = B and |GoZ'| = |GoZ|. Furthermore \V'\ < |2?| x |A(£?,.E)|. As \A(B,E)\ < B\ e \ and 
\E\ ^ |P| 2 i we have \V'\ ^ |H| 2 x . Since B is given in binary, we can suppose that B is at most 
exponential in the size of the input of the problem, which, in summary, shows that we can solve the threshold 
problem in exponential time. ◄ 
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E.3 Sabotage semantics on LTL games 

The linear temporal logic (LTL) is a logic whose formulas describe properties of infinite sequences of predicate. 
More formally, given a game arena G, a mapping Pred from vertices to a set of predicate P and an LTL formula 
<j>, the winning condition cj)(Pred ) is the set of plays vqVi ■ ■ • such that the sequence Pred(vo)Pred(v\) • • • satisfies 

<t>- 

Solving LTL-games, with their standard semantics, is already 2-EXPTIME-complete [Tfi] , The 2-EXPTIME 
membership can be obtained by turning an LTL formula <fr into a parity automaton whose size is doubly 
exponential in the size of (/>, and solving the parity game obtained by taking the product of the game arena with 
the automaton. 

When applying a sabotage semantics to an LTL game Q , we obtain a game [(?] of size exponential in the 
initial arena, and whose value function is a combination of a cost function and the LTL formula. By applying 
the same method as above, using the parity automaton associated with the formula and taking the product of 
the automaton with [(?], we obtain a game whose size is doubly exponential in the size of Q, and whose value 
function is a combination of a cost function and a parity objective. Applying the above result, one can show 
that this game can be solved in 2-EXPTIME with respect to the size of Q. 

As the standard semantics is equivalent to a sabotage semantics with budget 0, the problem remains 2- 
EXPTIM E-hard, and thus 2-EXPTIME-complete. 


